Ruling on data flow between EU & US may impact India’s IT sector

NEW DELHI: The European Union’s decision on Tuesday to invalidate a provision called ‘safe harbour’ that enabled data flow between the EU and the United States could have an impact on the Indian information technology sector which was considering a similar mechanism as a work-around to the EU’s stringent data protection regulations.

"With the court’s ruling, the requirements for any agreement to transfer data from the EU become clearer," said Gagan Sabharwal, director, Global Trade Development at industry lobby Nasscom.

India’s IT industry was looking at a similar mechanism, according to people familiar with the matter.

"Today’s ruling does not preclude any type of future agreement, whether it be partial adequacy or a safe harbour type agreement between the EU and India to ensure the free flow of data which is compliant with the EU’s data protection standards," said Sabharwal.

The Court of Justice of the European Union ruled the provision invalid.

The decision was made in a case filed by an Austrian citizen who had raised concerns about the safety of his personal data on Facebook, in light of US mass surveillance revelations made by National Security Agency contractor Edward Snowden in 2013. Under the EU’s Data Protection Directive, data could be transferred between EU and a third country only if it ensures an ‘adequate level’ of data protection, and allowed US companies to send data collected in EU to the US.

Nasscom president R Chandrashekhar had last year termed the EU’s stringent data protection laws a challenge. A recent Nasscom-Data Security Council of India survey pegged the loss to the Indian IT-BPO industry because of data protection issues in the EU at $2-2.5 billion for a sample size of 15 companies.

"This ruling confirms that the safe harbour mechanism is beyond repair, and puts an end to over a decade of privacy violations," said Estelle Massé, European policy analyst at Access in a statement.

The industry, however, expressed concern over the decision. "By immediately invalidating safe harbour, international business could be severely disrupted unless the EU institutions and data protection authorities offer alternative mechanisms and a reasonable transition period. Otherwise, the judgement could have far-reaching repercussions for consumers, employers and employees," said Susan Danger, managing director of AmCham EU in a statement.